Russian hackers from the Turla group have hacked into the email servers of government agencies in Kazakhstan and Romania to spy on them. They were particularly interested in emails related to NATO and EU representatives. For their espionage, they used a new program called Cereal, which could silently intercept emails containing Word and PDF documents.
Russian hackers from the Turla group have hacked into the email servers of government agencies in Kazakhstan and Romania to spy on them. They were particularly interested in emails related to NATO and EU representatives. For their espionage, they used a new program called Cereal, which could silently intercept emails containing Word and PDF documents.
This is reported by Bleeping Computer.
Cereal ran inside Microsoft Exchange, a system that companies and government agencies use for work email. One component of the program, CerealBox, scanned emails before they reached their recipients. So hackers could specify which messages they were interested in. For example, from specific senders, to specific addresses, with specific words in the subject line or the names of attached files.
If the message matched the specified conditions, CerealBox would create a copy of it, encrypt it, and store it on a server where hackers could retrieve it. Cereal also allowed hackers to search for information about employees and computers at the institution, store passwords, and view and delete files.
Researchers believe the program was designed for long-term, covert espionage. The program executed most of its commands in RAM, leaving relatively few traces on the computer.
The attacks are being carried out by Turla, also known as Snake, a Russian hacking group linked to the FSB. It has been active since at least 2004 and mainly targets government agencies, diplomatic missions, and defense organizations.
ESET researchers have published a list of infection signs that cybersecurity professionals can use to check servers for Cereal. To reduce the risk of such attacks, Microsoft recommends timely updating Exchange, restricting access to servers, and using tools to detect suspicious activity.
Previously, dev.ua wrote that Russian hackers used thousands of websites, mostly Ukrainian, to attack smartphones. Through the hacked web analytics service Plerdy, they distributed malicious code that could steal passwords, correspondence and other data.
